Privacy policy

Last updated: 14 October 2026

This Privacy Policy explains how we process personal data when you visit our website, shop with us, book or participate in our services, subscribe to our newsletter, or communicate with us by email, telephone or video call.

Controller and Contact

The controller responsible for the processing described in this policy is:

Lilian Galusca
Proprietor of LILYMARY e.U.
Operating under the brand The ClearMind Score
Lindengasse 56/18–19
1070 Vienna, Austria
Email: lily.amend@outlook.com
Telephone: +43 660 6656705

Personal Data and Sources

Depending on your interaction with us, we process:

• contact information, including name, email address, telephone number, billing and delivery addresses;
• order, payment-status and booking information, including products or services purchased, appointments, prices and transaction references;
• account information and preferences, where you create or use a customer account;
• correspondence and organisational information, such as questions, preferred training language and appointment arrangements;
• information necessary to organise children’s training, where parents or authorised adults subsequently provide it;
• newsletter subscription details and records of consent or withdrawal;
• cancellation, refund and statutory withdrawal requests and related records;
• technical information, including IP address, browser and device information, access times and online identifiers;
• with the relevant consent, website interaction and advertising event information, including page views, product views, searches, cart activity, checkout steps and purchases;
• with the relevant marketing consent, customer identifiers and contact information used to match advertising events to Meta users.

We receive information directly from you, through interactions with our website and, where necessary, from payment, booking and other service providers.

Full payment-card details are handled by the payment providers used at checkout. We receive the information necessary to administer payments and orders.

Purposes and Legal Bases

Orders and Bookings

We process information to handle orders, arrange appointments, deliver products and services, communicate about bookings and administer payments, cancellations and refunds. The legal basis is Article 6(1)(b) GDPR.

Enquiries

Enquiries relating to a potential or existing contract are processed under Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR, based on our legitimate interest in responding to communications.

Legal Obligations

We process and retain information to comply with accounting, tax and other legal obligations under Article 6(1)(c) GDPR.

Security and Legal Claims

Necessary processing to secure our systems, prevent misuse and establish, exercise or defend legal claims is based on Article 6(1)(f) GDPR or, where a legal obligation applies, Article 6(1)(c) GDPR. Our legitimate interests are secure operation and the protection of our business and legal rights.

Newsletters and Optional Tracking

Newsletters and optional analytics, advertising and personalisation technologies rely on consent under Article 6(1)(a) GDPR. Non-essential storage of, or access to, information on your device also requires consent under Section 165(3) of the Austrian Telecommunications Act 2021.

Information required to fulfil an order or booking is necessary for the relevant contract. Without it, we may be unable to provide the requested service. Newsletter subscriptions and optional tracking are voluntary.

Shopify, Customer Accounts and Payments

Our store is hosted by Shopify. For our European store, Shopify International Limited, Ireland, is generally the relevant contracting entity.

Shopify processes information to provide hosting, checkout, customer accounts, order administration, communications, security and related store functions. Payment providers receive the information necessary to process your chosen payment method.

Depending on the service, Shopify acts as our processor or as an independent controller.

Shopify Network Intelligence and Enhanced Services

Our store uses enhanced Shopify functions that may incorporate information about interactions with our store, other merchants and Shopify. These functions support personalisation, relevant advertising and understanding how customers interact with stores and advertisements.

For these services, information about your activity may be shared with Shopify and relevant service partners, including recipients outside your country. Shopify acts as an independent controller for its own processing described in its Consumer Privacy Policy.

Where consent is required, these optional uses depend on your consent choices. You can manage your choices through our website’s privacy settings. You may also contact Shopify or use its privacy portal to exercise rights concerning Shopify’s own processing.

Further information:

https://www.shopify.com/legal/privacy
https://www.shopify.com/legal/privacy/consumers
https://www.shopify.com/legal/dpa
https://privacy.shopify.com

Appointment Administration Through Appointo

We use Appointo, provided by Sidepanda Services LLP, India, to administer appointments.

Necessary customer, order and appointment information is processed to manage bookings, availability, confirmations and reminders. This processing supports contract preparation and performance under Article 6(1)(b) GDPR.

Where calendar or meeting integrations are used, necessary appointment and availability information is processed through the connected service.

Provider and privacy information:

https://apps.shopify.com/appointo-appointments-and-bookings

Email, Telephone and Video Communication

We process correspondence and information you provide by email or telephone to respond to enquiries, arrange bookings and deliver our services.

Where we arrange a Zoom call, Zoom Communications, Inc., United States, processes information needed to provide the meeting, including participant names, connection and device information, meeting metadata and the audio, video or chat content participants choose to share.

The legal basis for our processing is Article 6(1)(b) GDPR for contract-related conversations and Article 6(1)(f) GDPR for other enquiries.

Any recording or additional use of meeting content requires separate information about the purpose, legal basis and retention before it takes place.

Further information:

https://www.zoom.com/en/trust/privacy/privacy-statement/

Children’s Training

Our website and booking process are directed at adults. Children’s courses are booked by parents or other authorised adults.

We do not request the participating child’s name or age in our current online checkout. Necessary information about a child may instead be obtained subsequently from a parent or authorised adult by email, telephone or during a preparatory conversation.

Where we process such information, we use only what is necessary to organise and deliver the training. For information concerning a child who is not the contracting party, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in organising suitable training and identifying participants, taking particular account of the child’s interests and rights.

Information about a child provided in separate correspondence is not automatically included in Shopify orders or Meta advertising events merely because it is provided to us.

Please do not submit diagnoses, medical documents or other sensitive health information through general website, booking or enquiry fields. If processing such information becomes necessary, we will provide separate information and establish an appropriate legal basis under Articles 6 and 9 GDPR beforehand.

Facebook and Instagram Advertising

We advertise through Facebook and Instagram and use the Meta Pixel and Conversions API through Shopify’s “Facebook & Instagram by Meta” integration.

The relevant provider for the European Economic Area is Meta Platforms Ireland Limited, Ireland.

Maximum Data Sharing

Our Shopify integration uses the “Maximum” customer data-sharing level. This combines browser-based Meta Pixel tracking with server-to-server transmission through the Conversions API and additional customer-data matching features.

With your marketing consent, the integration processes store events such as page and product views, searches, cart activity, checkout steps and purchases. Event information may include product information, transaction value and currency, together with technical information such as IP address, browser and device details, referring URLs and online identifiers.

Where available, customer information including name, email address, telephone number and address or location information may also be transmitted for matching events to Meta users. Matching information may be hashed before transmission. Hashing does not make this information anonymous.

The Conversions API transmits event information, including purchase events, directly between Shopify and Meta servers. These transmissions are not necessarily blocked by browser-based advertising blockers. Server-side transmission does not remove the requirement for an appropriate legal basis.

We use this processing to measure advertising performance, attribute store activity and purchases to advertisements, improve event matching and optimise advertising. Meta may associate information with Facebook or Instagram accounts and process it according to its own privacy policy.

The legal basis for our consent-based advertising processing, including customer matching and server-side advertising event transmission, is Article 6(1)(a) GDPR. Non-essential storage or access on your device also relies on consent under Section 165(3) TKG 2021.

For the collection and transmission of event information covered by Meta’s Controller Addendum, we and Meta share responsibility as joint controllers. The addendum explains the allocation of responsibilities. Subsequent processing by Meta for its own purposes is governed by Meta’s privacy policy.

You can refuse marketing tracking or withdraw consent through our website’s cookie settings. This withdrawal applies to future consent-based advertising processing, including browser-based and server-side event sharing. Processing necessary to fulfil your order remains unaffected.

You can contact us concerning your rights, including where joint controllership applies.

Further information:

https://www.facebook.com/privacy/policy/
https://www.facebook.com/legal/technology_terms
https://www.facebook.com/legal/controller_addendum

Newsletters

We use Shopify Email or the corresponding Shopify Messaging functions for newsletters.

With your consent, we process your email address, your name where provided, and records documenting your subscription. The legal basis is Article 6(1)(a) GDPR.

You can unsubscribe at any time through the link in a newsletter or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

Necessary order confirmations, booking messages and contractual communications are not newsletters.

Cookies and Consent Settings

Essential cookies and similar technologies support requested functions such as shopping carts, authentication and security. Where strictly necessary, these do not require cookie consent.

Optional analytics, marketing and personalisation technologies require prior consent where applicable. This includes Meta advertising tracking and the related customer matching and event sharing described in Section 8.

Our cookie banner lets you accept or reject optional technologies and manage your preferences. Continuing to browse does not constitute consent.

You can reopen the website’s cookie settings to change or withdraw your choices. Refusing optional tracking does not prevent you from shopping or booking services.

Information about technologies and their duration is provided through the website’s cookie information and relevant provider information. Browser settings also allow you to delete cookies or restrict their use. Browser settings and advertising blockers alone do not necessarily prevent server-side event transmission.

Recipients and International Transfers

Depending on the purpose, recipients include:

• Shopify and payment providers;
• booking, email, calendar and video-meeting providers;
• Meta for consent-based advertising tracking, customer matching and event sharing;
• delivery and fulfilment providers where products are shipped;
• tax advisers, professional advisers and competent authorities where necessary.

Providers may process information outside the European Economic Area. Relevant countries may include Canada and the United States for Shopify, India for Appointo, and the United States for Meta and Zoom.

Transfers require a valid mechanism under Chapter V GDPR. Depending on the recipient and transfer, this may be an applicable adequacy decision or appropriate safeguards, such as EU Standard Contractual Clauses together with any necessary supplementary measures. The EU–US Data Privacy Framework applies only to covered transfers to participating certified organisations.

You can contact us for information about the mechanism applicable to a particular transfer and, where applicable, how to obtain a copy of relevant safeguards.

Retention

We retain information only as long as necessary for the relevant purpose.

Tax-relevant invoices and business records are generally retained for seven years from the end of the relevant calendar year, subject to longer legal requirements or ongoing proceedings.

Other order, booking and correspondence records are retained as necessary for administration and the establishment, exercise or defence of legal claims.

Information about participating children is retained only as long as necessary to organise and deliver training or fulfil an applicable legal obligation or justified record-keeping need. It is not automatically subject to the retention period for accounting records.

Newsletter marketing stops after withdrawal. Necessary consent and suppression records may be retained to document and honour your choice.

Cookie durations and providers’ retention practices are described in the relevant cookie and provider information. Withdrawal of consent does not automatically erase information already lawfully processed; your rights to erasure remain unaffected.

Your Rights

Subject to the conditions of applicable law, you have rights of access, rectification, erasure, restriction of processing and data portability.

Where processing relies on legitimate interests, you can object on grounds relating to your particular situation. You can object to processing for direct marketing at any time.

You can withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal.

To exercise your rights, contact lily.amend@outlook.com. We may request information necessary to verify your identity.

You can complain to a supervisory authority, particularly the Austrian Data Protection Authority:

https://www.dsb.gv.at

Where Shopify, Meta or another provider acts as an independent controller, you can also exercise your rights directly with that provider.

Changes to This Policy

We update this policy when our services or processing practices change. The current version is published on our website with its revision date. Where legally required, we provide additional notice of material changes.